CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...

CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...

Improving email security outcomes with real-world Microsoft Defender insights

Every benchmark tells a story. The most valuable ones tell us where to improve next. For five consecutive quarters Microsoft has published email security benchmarking reports to provide greater transparency into real-world protection outcomes. The results have shown strong Microsoft Defender...

Security update for nodejs18

This update for nodejs18 fixes the following issues: CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.3.0 ESRi MFSA 2026-93, bsc1280371 CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the...

pipelock

Pipelock 面向 AI Agent 的开源防火墙，实现可验证出站控制。...

CPLDCOMTrigger

CPLDCOMTrigger Descripción Un script de Python que depende de los scripts de Impacket para desencadenar la carga de un archivo .cpl en la memoria utilizando un objeto DCOM. La ruta del archivo CPL ya debe estar añadida al registro. El script utiliza la función Open en la interfaz IOpenControlPane...

CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

EUVD-2026-81908

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718

AsyncHttpClient (AHC) for Java is affected by a connection permit leak in versions 3.0.8 through 3.0.12. When a TLS connection fails before the handshake completes, NettyConnectListener removes the partition key lock permit from NettyResponseFuture before all failure paths are bound to the channe...

CVE-2025-51400

漏洞标题：LiveHelperChat 4. 保存更改。 5. 尝试使用该个人快捷消息，跨站脚本（XSS）将会执行。...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

hostintel

hostintel 此工具用于收集主机的各种情报来源。 Hostintel 采用模块化编写，因此可以轻松添加新的情报来源。 主机通过 FQDN 主机名、域名或 IP 地址来识别。此工具目前仅支持 IPv4。输出为 CSV 格式，发送到标准输出，因此数据可以保存或通过管道传输到其他程序。由于输出为 CSV 格式，电子表格软件（如 Excel）或数据库系统可以轻松导入数据。 我在 YouTube 上为这个工具做了一个简短的介绍：https://youtu.be/aYK0gILDA6w 此工具适用于 Python v2 和 Python v3。如果你发现它不适用于 Python v3，请提交一...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

EUVD-2026-81907

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...

CVE-2026-85721

CVE-2026-85721 affects the AsyncHttpClient (AHC) Java library. The automatic response decompressor on the HTTP/1.1 path (Http1ContentDecompressor) had no cumulative output-size limit, allowing a hostile or compromised server to send a small compressed response that expands across chunks until the...

CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install...